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What is claimed is: 

1. A device for calculating a result of a modular 
exponentiation, n being a modulus, d being an exponent and 
c being a quantity to be subjected to the modular 
exponentiation, comprising : 

means for calculating a first auxiliary quantity dp, 
wherein dp is defined as follows: 

dp = d mod (p - 1) , 

wherein p is a first prime number; 

means for calculating a second auxiliary quantity dq, 
wherein dq is defined as follows: 

dq = d mod (q - 1) , 

wherein q is a second prime number, 

wherein a product of p and q equals the modulus n; 

means for generating a random number (IRND); 

means for generating a third auxiliary quantity dp', 
wherein dp' is defined as follows: 

dp' = IRND x (p - 1) + dp; 

means for generating a fourth auxiliary quantity dq', 
wherein dq' is defined as follows: 

dq' = IRND x (q - 1) + dq; 

means for generating a fifth auxiliary quantity Mp, wherein 
the fifth auxiliary quantity Mp is defined as follows: 
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Mp = c dp mod p; 

means for generating a sixth auxiliary quantity Mq, wherein 
5 the sixth auxiliary quantity Mq is defined as follows: 

Mq = c dq mod q; and 

means for calculating the result of the modular 
10 exponentiation m, wherein m is defined as follows: 

m = Mq + [(Mp - Mq) x q" 1 mod p] x q. 

2. The device according to claim 1, further comprising 
15 means for generating a safety parameter T, 

wherein the means for generating the fifth auxiliary 
quantity Mp is formed to calculate the fifth auxiliary 
quantity as follows: 

20 

Mp = c dp ' mod (pT), and 

wherein the means for generating the sixth auxiliary 
quantity Mq is formed to calculate the sixth auxiliary 
25 quantity Mq as follows: 

Mq = c dq ' mod (q x T) . 

3. The device according to claim 2, further comprising 
30 means for calculating a seventh auxiliary quantity H7, 

wherein the seventh auxiliary quantity H7 is defined as 
follows : 

H7 = Mp x Mq mod T, and 

35 
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wherein means for calculating an eighth auxiliary quantity 
H8 is further provided, wherein the eighth auxiliary 
quantity H8 is defined as follows: 

5 H8 = c ca P - + dq-)mod(T-i> mo d T; and 

means for comparing the seventh and eighth auxiliary 
quantities, wherein the means for comparing is arranged to 
indicate a fault when the seventh and eighth auxiliary 
10 quantities differ. 

4. The device according to claim 1, being provided for an 
RSA decryption or RSA signature, m being a plain text 
message, d being a secret key and c being an encrypted 

15 message. 

5. A device for calculating a result of a modular 
exponentiation, n being a modulus, d being an exponent and 
c being a quantity to be subjected to the modular 

20 exponentiation, comprising: 

means for calculating a first auxiliary quantity dp, 
wherein dp is defined as follows: 

25 dp = d mod (p - 1) , 

wherein p is a first prime number; 

means for calculating a second auxiliary quantity dq, 
30 wherein dq is defined as follows: 

dq = d mod (q - 1 ) , 

wherein q is a second prime number, 

35 

wherein a product of p and q equals the modulus n; 
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means for providing a safety parameter T; 

means for generating a third auxiliary quantity p x T and a 
fourth auxiliary quantity q x T; 

means for generating a fifth auxiliary quantity Mp, wherein 
the fifth auxiliary quantity Mp is defined as follows: 

Mp = c dq mod (p x T) ; 

means for generating a sixth auxiliary quantity Mq, wherein 
the sixth auxiliary quantity Mq is defined as follows: 

Mq = c dq mod (q x T) ; and 

means for calculating the result of the modular 
exponentiation m, wherein m is defined as follows: 

m = Mq + [(Mp - Mq) x q' 1 mod p] x q. 

6. The device according to claim 5, wherein the safety 
parameter T is a prime number. 

7. The device according to claim 3, wherein the safety 
parameter T is small compared to the first prime number p 
and the second prime number q, respectively. 

8. A method for calculating a result of a modular 
exponentiation, n being a modulus, d being an exponent and 
c being a quantity to be subjected to the modular 
exponentiation, comprising the following steps: 

calculating a first auxiliary quantity dp, wherein dp is 
defined as follows: 



dp = d mod (p - 1) , 
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wherein p is a first prime number; 

calculating a second auxiliary quantity dq, wherein dq is 
defined as follows: 

5 

dq = d mod (q - 1) , 
wherein q is a second prime number, 
10 wherein a product of p and q equals the modulus n; 
providing a random number (IRND); 

generating a third auxiliary quantity dp', wherein dp' is 
15 defined as follows: 

dp' = IRND x (p - 1) + dp; 

generating a fourth auxiliary quantity dq', wherein dq' is 
20 defined as follows: 

dq' = IRND x (q - 1) + dq; 

generating a fifth auxiliary quantity Mp, wherein the fifth 
25 auxiliary quantity Mp is defined as follows: 

Mp = c dp mod p; 

generating a sixth auxiliary quantity Mq, wherein the sixth 
30 auxiliary quantity Mq is defined as follows: 

Mq = c dq mod q; and 

calculating the result of the modular exponentiation m, 
35 wherein m is defined as follows: 

m = Mq + [(Mp - Mq) x q" 1 mod p] x q. 
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9. A method for calculating a result of a modular 
exponentiation, n being a modulus, d being an exponent and 
c being a quantity to be subjected to the modular 
5 exponentiation, comprising the following steps: 

calculating a first auxiliary quantity dp, wherein dp is 
defined as follows: 

10 dp = d mod (p - 1) , 

wherein p is a prime number; 

calculating a second auxiliary quantity dq, wherein dq is 
15 defined as follows: 

dq = d mod (q - 1) , 

wherein q is a second prime number, 

20 

wherein a product of p and q equals the modulus n; 

generating a safety parameter T; 

25 generating a third auxiliary quantity p x T and a fourth 
auxiliary quantity q x T; 

generating a fifth auxiliary quantity Mp, wherein the fifth 
auxiliary quantity Mp is defined as follows: 

30 

Mp = c dp mod (p x T) ; 

generating a sixth auxiliary quantity Mq, wherein the sixth 
auxiliary quantity Mq is defined as follows: 

35 



Mq = c dq mod (q x T) ; and 
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calculating the result of the modular exponentiation m, 
wherein m is defined as follows: 



m = Mq + [(Mp - Mq) x q 1 mod p] x q. 



